Medium severity · published Oct 30, 2025
CVE-2023-53690
Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSS
4.8
CVSS
0.8%
EPSS
No
On KEV
Description
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add authentication servers via LDAP/AD integration could persist a malicious payload that executes in the context of other users' browsers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fusion · Nagios
before 4.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53690
Release Notes
https://www.nagios.com/changelog/nagios-fusion/
Vendor Advisory
https://www.nagios.com/products/security/#fusion
Third Party Advisory
https://www.vulncheck.com/advisories/nagios-fusion-ldap-ad-integration-stored-xss
More from Fusion
9.8
CVE-2020-28908
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios
9.8
CVE-2020-28907
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an…
9.8
CVE-2020-28904
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code
9.8
CVE-2020-28902
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php
9.8
CVE-2020-28901
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in…